Extend resource list in Kustomization file

[torredil]

What is this PR about? / Why do we need it?

This PR expands the resource list in our Kustomization file. It adds the role and rolebinding resource for leases and ensures they're created in the correct namespace, kube-system.

What testing is done?

Without this patch:

kubectl get roles --all-namespaces                                                                                                                                                                       
NAMESPACE     NAME                                             CREATED AT
kube-public   system:controller:bootstrap-signer               2023-06-16T14:15:38Z
kube-system   extension-apiserver-authentication-reader        2023-06-16T14:15:37Z
kube-system   kops-controller                                  2023-06-16T14:15:42Z
kube-system   system::leader-locking-kube-controller-manager   2023-06-16T14:15:38Z
kube-system   system::leader-locking-kube-scheduler            2023-06-16T14:15:38Z
kube-system   system::leader-locking-migration                 2023-06-16T14:15:44Z
kube-system   system:controller:bootstrap-signer               2023-06-16T14:15:37Z
kube-system   system:controller:cloud-provider                 2023-06-16T14:15:37Z
kube-system   system:controller:token-cleaner                  2023-06-16T14:15:37Z

With this patch:

kubectl get roles --all-namespaces                                                                                                                                                                          
NAMESPACE     NAME                                             CREATED AT
kube-public   system:controller:bootstrap-signer               2023-06-16T14:15:38Z
kube-system   ebs-csi-leases-role                              2023-06-16T14:22:09Z
kube-system   extension-apiserver-authentication-reader        2023-06-16T14:15:37Z
kube-system   kops-controller                                  2023-06-16T14:15:42Z
kube-system   system::leader-locking-kube-controller-manager   2023-06-16T14:15:38Z
kube-system   system::leader-locking-kube-scheduler            2023-06-16T14:15:38Z
kube-system   system::leader-locking-migration                 2023-06-16T14:15:44Z
kube-system   system:controller:bootstrap-signer               2023-06-16T14:15:37Z
kube-system   system:controller:cloud-provider                 2023-06-16T14:15:37Z
kube-system   system:controller:token-cleaner                  2023-06-16T14:15:37Z

kubectl get rolebinding --all-namespaces                                                                                                                                                                
NAMESPACE     NAME                                                       ROLE                                                  AGE
kube-public   system:controller:bootstrap-signer                         Role/system:controller:bootstrap-signer               8m27s
kube-system   cloud-controller-manager:apiserver-authentication-reader   Role/extension-apiserver-authentication-reader        8m18s
kube-system   ebs-csi-leases-rolebinding                                 Role/ebs-csi-leases-role                              116s
...

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[ConnorJC3]

Manually validated:

$ kubectl apply -k deploy/kubernetes/overlays/stable/ecr-public                   
serviceaccount/ebs-csi-controller-sa created
serviceaccount/ebs-csi-node-sa created
clusterrole.rbac.authorization.k8s.io/ebs-csi-node-role created
...

$ kubectl apply -f examples/kubernetes/dynamic-provisioning/manifests 
persistentvolumeclaim/ebs-claim created
pod/app created
storageclass.storage.k8s.io/ebs-sc created

$ kubectl get pvc
NAME        STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
ebs-claim   Bound    pvc-f2cbb4f2-b7b5-442b-b83c-921153101f48   4Gi        RWO            ebs-sc         6s

$ kubectl get pods
NAME   READY   STATUS    RESTARTS   AGE
app    1/1     Running   0          23s

/lgtm

[ConnorJC3]

/retest

[k8s-ci-robot]

@torredil: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-aws-ebs-csi-driver-test-e2e-external-eks-windows	c4e4ff5	link	false	/test pull-aws-ebs-csi-driver-test-e2e-external-eks-windows

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[ConnorJC3]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ConnorJC3

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ConnorJC3]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment